Vulnerability and Control Deficiency Analysis is the systematic process of identifying, categorizing, and evaluating weaknesses in IT systems, processes, and controls — then determining the gaps between how controls currently operate and how they must operate to reduce risk to an acceptable level. A vulnerability is a condition exploitable by a threat (e.g., an unpatched library, a misconfigured firewall). A control deficiency is the root cause explanation for why that vulnerability exists or persists: the control was never designed (absence), was poorly designed (design deficiency), or exists on paper but fails in practice (operating deficiency). The analysis output is a prioritized, business-impact-mapped deficiency register that drives remediation decisions.
Where it stops · what it isn't
- —IS: Systematic identification and evaluation of weaknesses in systems, processes, and controls, categorized by deficiency type (design, operating, absence) with root cause analysis
- —IS: The methodology that transforms raw vulnerability scanner output into prioritized, business-impact-mapped control deficiency findings
- —IS: Assessment of whether existing controls are adequate in design and effective in operation to mitigate identified risks
- —IS NOT: Threat modeling or risk scenario development — those activities assume vulnerabilities exist and use them to construct risk scenarios; this cubelet covers how vulnerabilities are found and classified
- —IS NOT: Risk quantification or risk rating — those are covered in Risk Analysis Methodologies; this cubelet produces the deficiency findings that quantification techniques consume
- —IS NOT: Penetration testing as an end in itself — penetration testing is one data-gathering technique within vulnerability analysis, not the full methodology
- —IS NOT: Remediation planning or control implementation — analysis identifies and prioritizes deficiencies; remediation is a downstream activity in the risk response lifecycle
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFIT Risk Assessment Domain (CRISC Domain 2)
REQUIRESRisk Scenario Development (crisc-d2-risk-scenario-development)IT Controls Fundamentals (preventive, detective, corrective control taxonomy)
ENABLESRisk Analysis Methodologies (crisc-d2-risk-analysis-methodologies)Risk Register Maintenance (crisc-d2-risk-register)Business Impact Analysis (crisc-d2-business-impact-analysis)
RELATED TORisk Events Threat Modeling (crisc-d2-threat-modeling)Inherent / Residual / Current Risk Assessment (crisc-d2-inherent-residual-current-risk)
CONSTRAINSControl Design and Implementation (CRISC Domain 3)